Claims-Based Edge Authorization via Local Agent Segmentation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The increasing complexity of managing authorization associations in software systems, particularly in edge computing devices, due to the large-scale interconnected nature of IoT devices, poses challenges in efficiently controlling access to resources and configuring settings across multiple levels, including cloud-based services and IoT edge devices.
Innovation Solution
A claims-based authorization system is implemented, where authorization associations are organized as claims between users, services, and objects, with a local claims provider agent determining access rights and generating tokens based on user identities and policies, and optionally referencing a cloud service-side claims provider for additional authorization, ensuring fine-grained access control.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If a traditional centralized access control system is used in cloud-based services, then authorization decisions can be made centrally, but the system complexity and response time increase when dealing with large-scale IoT edge devices
Solution Approach 1:
The patent segments the centralized access control system into distributed edge-based authorization agents that operate locally on IoT devices. Each agent independently evaluates authorization policies and makes access decisions without requiring centralized processing for every request, thereby reducing system complexity while maintaining authorization precision through local policy enforcement
Solution Approach 2:
The patent introduces a new dimension of operation by moving authorization decisions from the cloud dimension to the edge device dimension. This spatial distribution across multiple dimensions (cloud + edge) allows the system to maintain centralized policy management while enabling distributed decision-making, reducing both complexity and response time
2Reliability
If fine-grained access control is implemented across multiple levels (cloud and edge), then security and authorization precision improve, but the complexity of managing authorization associations increases
Solution Approach 1:
The patent applies preliminary action by pre-configuring authorization policies and association rules on edge devices before runtime. The authorization agents are pre-loaded with policy sets and association metadata, enabling them to make immediate authorization decisions without complex real-time computations, thus improving security while simplifying runtime management
Solution Approach 2:
The patent uses copying by replicating authorization agents and policy sets across multiple edge devices. Each device receives a copy of the necessary authorization logic and association data, enabling independent local decision-making without requiring continuous communication with the central system, thereby improving security while reducing management complexity
Data Source
Figure 1
Figure 2A~2B
Figure 3A~3C
AI summary
Systems and methods for controlling an edge computing device. The method includes, receiving a user input requesting access to a resource of the edge computing device, determining whether the user has privileges to access the resource by: formulating a claims request which requests claims based on the determined identity of the user, sending the claims request to a local claims provider agent executed by a processor of the edge computing device, determining, based on claim request handling factors, whether the local claims provider agent can generate a token including the requested claims, and if so, generating the token with the requested claims; if not, a request may be sent to a cloud service-side claims provider to receive the token. The method includes authorizing access to the resource based on a predetermined policy that specifies the presence of a predefined resource parameter in the requested claims is sufficient.